What is Amazon Inspector?
Amazon Inspector automates security assessment to improve the
security and compliance of applications deployed on AWS. Using
the best practices, it automatically assesses applications for
exposure, vulnerabilities, and after an assessment, produces a
detailed list of security findings prioritized by level of
severity. You can review these findings directly or as part of
detailed assessment reports that are available via the Amazon
Inspector console or API.
Components of Amazon Inspector:
-
Amazon Inspector Agent:
This software agent collects a wide set of configuration
data (telemetry) and can be installed on the EC2 instances
that are included in the assessment target.
-
Assessment Run:
It’s a process of discovering potential security
issues through the analysis of your assessment target's
configuration against specified rules packages. During an
assessment run, Amazon Inspector monitors, collects, and
analyzes configuration data (telemetry) from resources
within the specified target. Further, Amazon Inspector
analyzes the data and compares it against a set of security
rules packages that are specified in the assessment template
used during the assessment run. A completed assessment run
produces a list of findings, which are potential security
issues of various levels of severity.
-
Assessment Target:
Assessment target is a collection of AWS resources that work
together as a unit to help you accomplish your business
goals. Amazon Inspector evaluates the security state of such
resources that constitute the assessment target.
-
Assessment Template:
It is a configuration that is used during your assessment
run. The template includes:
-
Rules packages used by Amazon Inspector to evaluate your
assessment target.
-
Amazon SNS topics you want Amazon Inspector to send
notifications for assessment run states and
findings.
-
Tags (key-value pairs) that you can assign to findings
generated by the assessment run.
- The duration of the assessment run.
-
Finding:
It’s a potential security issue discovered by the
Amazon Inspector during an assessment run of the specified
target. Findings are displayed in the Amazon Inspector
console or retrieved through the API. They contain both a
detailed description of the security issue and a
recommendation on how to fix it.
-
Rule:
It is a security check performed during an assessment run.
When a rule detects a potential security issue, Amazon
Inspector generates a finding that describes the
issue.
-
Rules Package:
It is a collection of rules that corresponds to a security
goal that you might have. You can specify your security goal
by selecting the appropriate rules package when you create
an Amazon Inspector assessment template.
-
Telemetry: These are installed package information and software
configuration for an EC2 instance. Amazon Inspector collects
this data during an assessment run.
Features of Amazon Inspector:
-
Configuration Scanning and Activity Monitoring Engine: By providing an agent, Amazon Inspector analyzes the system
and the resource configuration. Also, it monitors activity
to determine how an assessment target looks like, how it
behaves, and its dependent components. The combination of
this telemetry provides a complete picture of the target and
its potential security or compliance issues.
-
Built-In Content Library: Amazon Inspector includes a built-in library of rules and
reports that include checks against best practices, common
compliance standards, and vulnerabilities. These checks
further include detailed recommended steps for resolving
potential security issues.
-
Automation Through an API: Amazon Inspector can be automated fully through an API.
It allows you to incorporate security testing into the
development and design process, including selecting,
executing, and reporting the results of those tests.
Benefits of Amazon Inspector:
-
Find Application Security Issues:
Amazon Inspector identifies security vulnerabilities, as
well as deviations from security best practices in
applications, before deployment and while they are running
in a production environment. This way overall security of
your applications deployed on AWS improves.
-
Bring Security Into DevOps: Amazon Inspector, an API-driven service, analyzes network
configurations in your AWS account and uses an optional
agent for visibility into your Amazon EC2 instances. Thus,
it eases for you to build Inspector assessments right into
your existing DevOps process, decentralizing and automating
vulnerability assessments, and empowering your development
and operations teams to make security assessments an
integral part of the deployment process.
-
Enhance Development Agility:
Amazon Inspector reduces the risk of introducing security
issues during development and deployment by automating the
security assessment of your applications and proactively
identifying vulnerabilities. This allows you to develop and
iterate on new applications quickly and assess compliance
with best practices and policies.
-
Leverage AWS Security Expertise:
The AWS security organization is continuously assessing the
AWS environment and updating a knowledge base of security
best practices and rules. Amazon Inspector provides this
expertise to you in the form of a service that simplifies
the process of establishing and enforcing best practices
within your AWS environment.
-
Update Security Compliance: Amazon Inspector gives security teams and auditors
visibility into the security testing that is being performed
during the development of applications on AWS. This
streamlines the process of validating and demonstrating that
security and compliance standards and ensures only the best
practices are being followed throughout the development
process.
-
Strengthen Security Standards: Amazon Inspector allows you to define standards and best
practices for your applications and validate adherence to
these standards. This simplifies the enforcement of your
organization’s security standards and best practices
and helps proactively manage security issues before they
impact your production application.
Conclusion
Whether you’re a big organization or a small company,
no matter what sort of development approach you follow, you
won’t be entertained unless you ensure security. But if
you’re mistaken about ensuring security with manual
efforts, then it is not practical as well. What you need to
concentrate on is something like Amazon Inspector that is way
better than manual efforts and more trustworthy. It
continuously monitors AWS resources and identifies potential
vulnerabilities, their impacts on your application, and based
on that it offers solutions.
